How to Fix Duplicate ProxyAddresses Errors in Azure AD Connect
Question details
Users are experiencing synchronization failures in Azure AD Connect due to conflicting proxyAddresses values in the local Active Directory environment.
- Product
- Azure AD Connect
- Device & OS
- not provided
- Scenario
- Synchronizing user accounts from an on-premises Active Directory setup to Azure Active Directory.
- Observed behavior
- Azure AD Connect fails to synchronize specific user objects because duplicate SMTP proxy email addresses already exist across multiple accounts in the local directory.
Ensure you have Domain Administrator privileges and review your synchronization rules before making direct modifications to user attributes in Active Directory.
Identify and Remove Duplicate SMTP Addresses in Active Directory
Locate the conflicting proxyAddresses in your local Active Directory and ensure all SMTP addresses are unique across the environment.
SMTP addresses must be entirely unique across all synchronized objects. When Azure AD Connect detects two users sharing the same primary or proxy email address, it halts the synchronization for the conflicting object to maintain directory integrity.
Log in to your primary domain controller and launch the 'Active Directory Users and Computers' management console.
Use the built-in search feature or run a PowerShell query (such as Get-ADUser) to find the specific user accounts sharing the duplicate SMTP address.
Right-click the conflicting user object, select 'Properties', navigate to the 'Attribute Editor' tab, and double-click the 'proxyAddresses' attribute.
Select the conflicting SMTP address from the list, click the 'Remove' button, and then click 'OK' to save your changes.
Open PowerShell on your Azure AD Connect server and run 'Start-ADSyncSyncCycle -PolicyType Delta' to immediately apply the corrections and sync the user to Microsoft Entra ID.
Simplify Your IT Documentation with WPS Office
Managing Active Directory environments requires thorough documentation and reporting. WPS Office offers a completely free, lightweight, and highly compatible alternative to Microsoft Office, making it incredibly easy to manage IT logs, PowerShell script references, and network architecture PDFs without bogging down your system.
- 1. Download the Installer: Visit the official WPS Office website and click 'Download WPS Office Free' to get the installer.
- 2. Complete the Installation: Run the lightweight setup file and follow the brief on-screen instructions to install the suite in minutes.
- 3. Manage IT Reports Instantly: Open your existing Microsoft Office administration reports seamlessly with perfect formatting and zero data loss.
Frequently Asked Questions
Can two users have the same proxyAddresses in Active Directory?
No. SMTP addresses defined in the proxyAddresses attribute must be strictly unique across all objects in Active Directory. Duplicates will trigger critical Azure AD Connect synchronization errors.
How do I find duplicate proxyAddresses using PowerShell?
You can export all users and their proxyAddresses attributes to a spreadsheet format, or use advanced Active Directory PowerShell scripts to dynamically group and filter users by identical SMTP addresses.
How long does it take for Azure AD to sync after fixing duplicates?
If you wait for the automatic cycle, Azure AD Connect synchronizes every 30 minutes by default. You can also manually trigger a delta sync via PowerShell for immediate updates to the cloud.
What is the difference between primary and proxy email addresses?
The primary address usually begins with an uppercase 'SMTP:' in the attribute editor and represents the main reply-to address. Proxy addresses use lowercase 'smtp:' and serve as additional secondary aliases. Both variants must remain completely unique.
